31477 matches found
CVE-2026-19855: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...
The vulnerability of the RoundCube Webmail email client, related to insufficient validation of requests on the server side, allows a hacker to execute an SSRF attack.
The vulnerability of the RoundCube Webmail email client is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...
Security Bulletin: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
Summary IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-16190 DESCRIPTION: IBM WebSphere Application Server is affected by an authorization bypass vulnerability. CWE:CWE-862: Missing Authorization CVSS...
Server-side Request Forgery (SSRF)
Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resolveContent method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbound URL fetches b...
CVE-2026-54745
A flaw was found in Kubeflow Pipelines. An unauthenticated attacker can exploit a Server-Side Request Forgery SSRF and HTTP smuggling vulnerability through the /proxy/ route. This allows the attacker to bypass authorization and forward arbitrary requests to internal services. Consequently, this c...
CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
EUVD-2026-74189
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
CVE-2026-66304
Server-side request forgery ssrf in Skype for Business allows an unauthorized attacker to disclose information over a network...
CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery
A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...
CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery
A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...
CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery
A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...
CVE-2026-66304
CVE-2026-66304 is a server-side request forgery (SSRF) vulnerability in Skype for Business Server , affecting the Subscription Edition , 2019 , and 2015 releases. An unauthorized remote attacker with no privileges required can exploit the flaw to disclose information over a network . The CVSS v3....
EUVD-2026-74043
Server-side request forgery ssrf in Skype for Business allows an unauthorized attacker to disclose information over a network...
CVE-2026-81357
Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69904
Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...
CVE-2026-69683
Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...
EUVD-2026-73924
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...
EUVD-2026-73724
Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...
CVE-2026-81357
CVE-2026-81357 is a server-side request forgery (SSRF) vulnerability in Visual Studio Code that allows an unauthorized attacker to bypass a security feature over a network . The vulnerability requires user interaction but no prior privileges, and has a CVSS 3.1 score of 8.2 (HIGH) with high confi...